49

Downsides of Transparent Data Encryption compared to Always Encrypted: Only protects data at rest - backups and data files are "safe" but data in motion or in memory is vulnerable Whole database only All data is encrypted the same way Backup compression can take longer and be counter-productive Well, actually, there are some improvements here in SQL Server ...


10

I have yet to come across a definitive "Best Practices" list regarding multiple encryption types for SQL Server, but in your situation I would probably recommend the following: Encrypt necessary data using Always Encrypt Its the new hotness. You're on 2016, enjoy it! Better security - the DBA can't decrypt data since the key is stored outside the database. ...


6

The major difference I know is Normal Column Encryption The normal Column encryption which was introduced from SQL Server 2005 uses function Encryptbycert to encrypt the columns. It is not as secured as compared to Always Encrypted in terms that with this method data is submitted as clear text in SQL Server and this data can be seen from traces. A DBA, who ...


5

My guess is that you are not checking the following from this guide, which states that you can't use DECLARE and SET separately: Declared and initialized in the same statement (inline initialization). SSMS will not parameterize variables declared using separate SET statements. I get the same error you get when I write code like what you have in the ...


5

Always encrypted does not check for validity of the CMK certificate explicitly. Always Encrypted treats the CMK certificate purely as (PK, SK) pair. so you can use the expired cert without running into any issues. However, the best practice is to rotate the CMK at regular intervals. Always Encrypted provides a mechanism to rotate CMK without incurring any ...


5

It appears that you have to create a CMK and CEK in tempdb. This command Works On My Machine®, and is largely copy/pasted from BOL articles. USE tempdb CREATE COLUMN MASTER KEY cmk_whatever WITH ( KEY_STORE_PROVIDER_NAME = N'cmk_whatever', KEY_PATH = 'Current User/Personal/f2260f28d909d21c642a3d8e0b45a830e79a1420' ); CREATE COLUMN ...


4

AE is intended to protect sensitive data end-to-end. That's why keys are held by the client, not server. In SQL Server 2016 granularity is at the column level. If you want to AE the entire database, you'd have to do it one column at a time. That doesn't really make sense and doesn't fit the AE scenario unless all data in your database is sensitive. ...


4

Does your table have a primary key or a clustered index? There is a known issue in the wizard/PowerShell that may cause it to run out of memory, if the table does not have a primary or a clustered index, so one workaround could be to create a primary key/clustered index, if you don't have it already. You can also try to use 64-bit PowerShell. Using 32-bit ...


4

For large tables I would definitely work with T-SQL or Powershell rather than the wizard - clunky UIs that run all kinds of background things and take over-protective locks do not have a great track record. For example, this wizard actually offers an option to generate Powershell: I would do that. Here is what it produces: # Generated by SQL Server ...


4

The documentation states, in the opening paragraph: The driver encrypts the data in sensitive columns before passing the data to the Database Engine, and automatically rewrites queries so that the semantics to the application are preserved. Similarly, the driver transparently decrypts data, stored in encrypted database columns, contained in query results. ...


4

The whole entire data/log file doesn't get encrypted. Only the specific fields you encrypt are encrypted, and yes, those are encrypted in the data, log, and backup files. SQL Server never sees the unencrypted values. In the docs for Always Encrypted, Microsoft explains: Always Encrypted allows clients to encrypt sensitive data inside client applications ...


4

How can I remove the "Always-Encrypted-Auto1" entry? Since there isn't a way in the SSMS GUI and I doubt you want to write your own code to find out, look in %APPDATA%\Microsoft\Crypto\Keys and attempt to figure out based on date which file it may be.


4

You are fighting against the technology that you're using. The point of Always Encrypted is that data is only decrypted on the client. A few quotes from the documentation: To successfully update the column [ed: as opposed to updating in T-SQL], do the following: SELECT the data out of the SSN column, and store it as a result set in the application. ...


3

Certs from trusted CAs (like VeriSign) are used when you need a certificate that must be able to prove its issuer, purpose, validity, etc... Certs for data encryption like Always Encrypted typically do not require such proof since your certs typically don't float beyond your org. I don't know of any use case where you would benefit from using a 3rd party CA ...


3

Simply put, TDE is data encrypted at rest (On disk) and AE is data encrypted on the wire in addition.


3

You might be running into a bug in how SQL Server vNext CTP1.2 handles filepaths. To CREATE CERTIFICATE from a backup, you currently need to pre-pend a 'c:' and use backslashes ('\') instead of forward slashes. This will be fixed soon :) Here's a demo for the scenario you're trying to do (backup an encrypted database and restore it on a SQL vNext on Linux ...


3

See this description of how Always Encrypted works. Basically, SQL Server does not have access to the keys required to decrypt data into plain text. This work is performed by the client driver and in your scenario, the client driver will go looking for the certificate to decrypt the data for the web application but on failing to find the correct certificate, ...


2

Bulk Insert operations in the manner you are describing are not supported for encrypted column via SSMS. Please refer to this (https://blogs.msdn.microsoft.com/sqlsecurity/2015/07/28/encrypting-existing-data-with-always-encrypted/) article to migrate your existing data to Always Encrypted Also, please note that doing bulk inserts through a C# (.NET 4.6.1+ ...


2

The Always Encrypted feature provides end-to-end encryption, which encrypts data both in-flight, and at rest. Data is encrypted & decrypted on the client at the driver. Data is encrypted everywhere except for on he client machine. This is one step beyond encryption at rest (which is handled in SQL Server by Transparent Data Encryption). Other RDBMS ...


2

I am guessing that the CEK [ColEnc1] resides in the same database that the table listofdates resides in. Try creating the CMK and CEK in tempdb table and the error should be gone.


2

Then I export the certificate and import it into the machine where the SQL Server is running. That defeats the purpose of using Always Encrypted if the server that is running SQL Server also has the certificate to decrypt all the data. Please, please, please don't do this! Put it on the client machine or a "tools" or "intermediate loading" machine to get ...


2

You need to use variables for the values, so that SSMS can parameterize the query against the API that it is using. Something like: DECLARE @fname varchar(30) = 'Kula' DECLARE @ename varchar(30) = 'Kalle' DECLARE @pnr varchar(11) = '752312-4545' DECLARE @age tinyint = 45 insert into dbo.Personer2 (Förnamn, Efternamn, Personnummer, Ålder) VALUES (@...


2

So I figured out what I was doing wrong AlwaysEncrypted requires the variables to be defined in line: DECLARE @OPERATION_ID int = 4 DECLARE @PARAMETER_NAME varchar(100) = 'algorithm' DECLARE @PARAMETER_METRIC varchar(100) = 'algorithm' DECLARE @PARAMETER_VALUE varchar(100) = 'TestValue3' INSERT INTO [dbo].[TOKEN_PARAMETER] (OPERATION_ID, PARAMETER_NAME, ...


2

SQL Server 2017 documentation: Always Encrypted is not supported for the columns with the below characteristics: (...) String (varchar, char, etc.) columns with non-bin2 collations (...) Source: Always Encrypted Looks like it is changing in SQL Server 2019: Since its initial release, Always Encrypted has had a restriction regarding the use of collations: ...


2

After setting up Always Encrypted, I can see a certificate in my Current User Correct, you've stated that the Column Master Key (CMK) will be created/stored there. Most likely this was done via the GUI to generate a new key and save it there. There are other options as well for the CMK. [...] under the key_path I see this location, but there is no ...


2

Deterministic encryption will produce the same value as long as the inputs are the same. In database terms it means that: Queries can perform equality comparison on columns encrypted using deterministic encryption, but no other operations (for example, greater/less than, pattern matching using the LIKE operator, or arithmetical operations). Source So ...


2

In this join, the HR.[Employee_ID] is not encrypted, and part of the [vw_Employees] view, and the ET.[EmployeeID] is the encrypted column. Why does this equality join not work? The documentation states that encrypted columns can be used in equality joins, which this clearly is. Take a closer look at the documentation: Deterministic encryption always ...


2

You are using column encryption. This is not always-encrypted. When you backup your data base and restore it, you only need to recover the master key. Anything else will be restored through the backup file. You can restore the master key with this command: USE [Your_DB_Name] GO OPEN MASTER KEY DECRYPTION BY PASSWORD = 'Your_MasterKey_Password' ALTER MASTER ...


1

Assumptions: you're referring to ASE's column-level encryption which requires a user/role to have decrypt permissions to see the actual data (as opposed to database-level encryption which merely encrypts the data out on disk) ASE encrypted data is replicated as varbinary; this means that at no time is the data decrypted and/or re-encrypted; of course, it ...


1

SQL Server has had column encryption with server-managed keys since SQL 2005. See Encrypt a Column of Data. AlwaysEncrypted uses client-side keys.


Only top voted, non community-wiki answers of a minimum length are eligible